All Questions

3
votes
3answers
101 views

Largest message size for XChaCha20-Poly1305

libsodium documentation says that XChaCha20-Poly1305 can encrypt a message of arbitrary size. However, the only specification available (still a draft) explains that under the hood the IETF version ...
0
votes
0answers
24 views

How can I combine Quorum and Zero Knowledge Range Proofs

I have 20 years of experience at java JEE coding, and 10 years in devops as well, but no experience with blockchains, or the Go language. I want to setup a cluster of Quorum blockchain nodes, ...
-1
votes
1answer
64 views

How does ECDHE fit with AES and SHA?

Hi I'm trying to piece together how AES, ECDHE, and SHA all work together. From what I understand ECDHE is uses asymmetric cryptography to generate a shared key from a public and private key which are ...
-2
votes
0answers
34 views

Riemann's Hypothesis and Miller-Rabin test for primality [closed]

please what is the complexity of Miller Rabin the case we accept Hypothesis of Riemann
1
vote
1answer
32 views

How to prove element equality in G1 using Groth-Sahai proofs

In the BeleniosRF e-voting scheme, Groth-Sahai proofs with the "Instantiation based on the SXDH assumption" are used (see https://eprint.iacr.org/2007/155, version 20160411:065033, page 24). In the ...
0
votes
1answer
50 views

Block Cipher CTR mode when offset is not known by receiver

When an encrypted message is received, it can be easily decrypted if the offset (=counter) of the received message is known (and also the required private key of course). This allows for random access ...
0
votes
1answer
27 views

Why do we approximate R-1 rounds during linear or differential cryptanalysis?

I am currently looking into differential and linear cryptanalysis. I am however unsure why do we only approximate only R-1 out of R rounds - is it because we already know the output or why ? I have ...
0
votes
1answer
56 views

Apple CryptoKit - Understanding its portability

I've been playing with Apple's CryptoKit (their effort to make their old CommonCrypto lib more modern and easy to use via Swift, their programming language). I'm interested to see how portable it is.....
1
vote
0answers
33 views

Gennaro multi trapdoor commitment scheme

In the Scheme Based on the SDH Assumption (page 11 of the paper https://link.springer.com/content/pdf/10.1007%2F978-3-540-28628-8_14.pdf), how does the commitment get revealed with the master trapdoor ...
2
votes
1answer
49 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
-1
votes
2answers
60 views

How to find the key of XOR encryption in Java?

I am trying to find the key of an XOR-encrypted string in Java. It is very probable that the key is eight characters long. I have the encrypted string. I do not understand how to go backwards and ...
0
votes
0answers
23 views

How do BLS signatures prove a private key belongs to public key

In a Boneh-Lynn-Shacham sig the public key: Each of our devices has a signer’s number i = 1,2,3 that represent its place in a set, a private key pki and a corresponding public key Pi = pki×G. ...
0
votes
0answers
35 views

Are the factors for a number n, more likely to lie within a certain range of n?

Given $n=ab$ is $a$ or $b$ more likely to be between $1$ and $n/2$ as an example? Where $a$ and $b$ are prime
1
vote
0answers
68 views

Multivariate Cryptography: Security of the affine transform T

In this question, I'd like to discuss the security of the last transformation $T$ employed in the construction of a MV-scheme. MVCrypto is based on solving a system of polynomial equations, but ...
1
vote
1answer
48 views

Valid private keys on curve25519

Given that valid private keys on curve25519 must be less than the order of the curve which is (as I understand) already smaller than 2^256, AND a valid key must be clamped to be divisible by 8 and ...
2
votes
1answer
53 views

AES with no SubByte - recover the key

I was wondering if it was possible to recover an AES-128 blockcipher key, knowing that there is no substitution box (it can be seen as the identity mapping). I thought it would be feasible. I ...
1
vote
1answer
62 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
0
votes
2answers
44 views

Many time pad if cleartext contains arbitrary bytes

I understand the problem of reusing the same key in the one-time pad if the cleartext message only contains characters such as A-Z, a-z and spaces. But what if our cleartext is composed of arbitrary ...
1
vote
2answers
51 views

How are “string-messages” converted to “number-messages”?

Textbooks most of the time assume that a message, say "secret", is already represented in number format, say "8614" (just as an example!). But how exactly is this conversion achieved? I imagine it to ...
3
votes
1answer
46 views

Is inversion always cheap with Twisted Edwards curves?

I'm reading on Jubjub, which is planned for the next upgrade of Zcash. It is based on a Twisted Edwards curve with parameters $a = -1$ and $d = −(10240/10241)$. The reading says Jubjub does not need ...
2
votes
1answer
44 views

What would happen in DSA/ECDSA if there were a collision in $r$ but not $k$?

In DSA, the value of $r$ is generated as: $r = (g^k \bmod p) \bmod q$ ECDSA is similar, using the $x$ coordinate of the generator $g$ scalar-multiplied by $k$, again taken modulo $q$. It's well-...
2
votes
0answers
52 views

What was used for symmetric message authentication before HMAC was invented?

Currently, Carter Wegman MACs are popular. Before that, HMAC was popular. What was popular before HMAC? Was it CBC-MAC? Something else? I know about NIST FIPS 113 "Data Authentication Algorithm" ...
3
votes
1answer
97 views

What makes lattice-based cryptography quantum-resistant?

As opposed to RSA or elliptic curve cryptography?
2
votes
1answer
62 views

Bit-strength of discrete logarithm for a group of integers modulo a safe prime

Preliminaries Let $p$ be a safe prime number. Let $\mathbb{Z}_p^*$ be the multiplicative group of integers modulo $p$. We have $\mathbb{Z}_p = \{\,a \in \mathbb{Z} \mid 1 \le a \lt p\,\}$ . Let $g \...
1
vote
2answers
55 views

Complexity of number field sieve theorem does not match with security of elliptic curves

Number field sieve algorithm can is used to break discrete logarithm on field $F_{p^n}$. The algorithm has time complexity $\exp((c+o(1))\cdot(\log p^n)^{1/3}\cdot(\log \log p^n)^{2/3}$. Originally ...
0
votes
1answer
72 views

Can machine learning/AI lower the security existing cryptographic protocols similar to quantum computers? [duplicate]

Initial thinking would be not unless the protocol revealed sensitive local information that could then be analysed by an ML algorithm and applied globally. local meaning I see messages from Alice and ...
4
votes
2answers
220 views

Why is a common reference string needed in zero knowledge proofs?

Can we have a non-trivial language without a CRS? Why?
0
votes
0answers
43 views

RSA attack with really big N? [duplicate]

N is a really big number,2466 digits in base 10,and e is 65537,I thought n might be factored,but it didn't work. N is such a big number and e is 65537,smaller than N,so how to attack it?
1
vote
1answer
66 views

pwd-hash like algorithm which can be computed on paper

"Common password problem" is well known problem, when user uses one password for many resources (web sites, logins to computers, etc...) For example, if one web site loses it' database, which contains ...
4
votes
1answer
101 views

Cryptography resources for programmers

As a senior programmer entering blockchain projects, i'm looking for a comprehensive introduction to relevant cryptographic tools/primitives, preferably one that puts less emphasis on the math and ...
0
votes
0answers
21 views

Help to understand the KDM in SP800-56A, and the usage of “FixedInfo”

Can somebody help me to understand the LOGIC behind Key-Derivation Methods (SP800 56A CH5.8)? This is my common understanding and please correct me if any wrong.. Alice and Bob can general individual ...
0
votes
2answers
47 views

Diffie-Hellman Primitives in SP800-56A

I wonder if someone can give an explain about the different between two Diffie-Hellman Primitives defined in SP800-56A, CH5.7.1 5.7.1.1 Finite Field Cryptography Diffie-Hellman (FFC DH) Primitive 5.7....
0
votes
0answers
25 views

Bit based Division Property of AES MixColumn

I'm studying about division property that is proposed by todo et al. I have a question about division property for AES mixcolumn. In bit based division property, how can I calculate output division ...
1
vote
1answer
69 views

How should I address message size limits in RSA encryption?

I am making an end-to-end encryption software program in Java using RSA. I am using BigIntegers and its number theory methods. (I know this is a very slow approach, but I just want to learn to the ...
0
votes
1answer
83 views

Could a quantum computer recover files from ransomware if the attacker doubly encrypted them with RSA-4096?

How would a quantum computer decrypt a file (or find the keys to such a file) if it were encrypted with standard RSA 4096 encryption, but encrypted two times with different keys? The keys are known by ...
2
votes
2answers
92 views

Why aren't Complex number fields used in cryptography?

Most of the cryptography is limited to use of real integer fields. Complex numbers are seldom used. Is there any reason for it? Wouldn't complex numbers provide more structure? If there is already ...
0
votes
1answer
40 views

Question regarding of the ECC test vector format

I am trying to find some ECC test vector for using. I just find some post (like this) and github resource (like this ) They are good reference to my C test code but I'd like to get some more advice... ...
3
votes
0answers
63 views

As of 2019, what are the most important questions in zero-knowledge research? [on hold]

Important meaning; where the most research is being focussed. Maybe because a break-though seems possible or a break-through would have big consequences. Any questions that are being researched ...
-3
votes
1answer
71 views

how to decrypt if p=q in RSA [duplicate]

p,q should be different,but if I let p = q,and encrypt the plaintext,then I can't decrypt it,so can decrypt it?
0
votes
0answers
39 views

How to calculate RSA public key by modulus unknown format and exponant value?

I'm trying to calculate the RSA public key by modulus value and exponent value. I got the values from an API by Apple. You can find the API here. The documentation for the API can be found here. ...
1
vote
0answers
31 views

Meet-in-the-middle attack (on custom encryption scheme)

This is a question I had from an exercise session. Exercise: First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES ...
2
votes
1answer
63 views

In GnuPG, what's the difference between --s2k-cipher-algo and --cipher-algo? [duplicate]

I want to change some encryption options while using GnuPG to encrypt a file symmetrically. 1) However, for choosing the cipher algorithm, GnuPG has two commands and I don't know which one to use. ...
1
vote
1answer
67 views

RSA - Very big Modulus and Ciphertext

Is there a known weakness in RSA when the value of modulus (n) is very large? n = 2466 digits e = 65537 c = 2466 digits n cannot be factorized. I checked on ...
1
vote
2answers
81 views

Invalid curve attack: finding low order points

Background Here's a description of page 182 of "Guide to Elliptic Curve Cryptography" by Hankerson, Menezes and Vanstone. Here's a quote from that page: The main observation in invalid-curve ...
1
vote
1answer
49 views

Is it possible to change the generator without knowing the private key used?

For example, prover sends P = xG and verifier somehow sends back P = xH without learning x. Is this possible?
3
votes
1answer
59 views

How would I prove a number is not within a range?

This would be the opposite of a rangeproof. For example, I wanted to prove that my number was not between 0 and 200 in zero knowledge? On a separate note: how would I prove that I hold a number, but ...
1
vote
0answers
54 views

How do I find an efficient sqrt algorithm for primes? [closed]

For example, If my prime was congruent to 3 mod 5. Is there a list where I can find for these primes which do not take the form 3 mod 4? Edit: Excluding the general tonelli-shanks algorithm
5
votes
10answers
494 views

Soft question: What are examples of beautiful proofs in cryptography? [on hold]

These may include any proofs, reductions, constructions, etc. For example, simple solutions to problems which at first sight seem difficult. Elegant construction that hide deep mathematical concepts, ...
0
votes
1answer
38 views

Symmetric encryption construction (meet-in-the-middle attack)

This is a question I had from an exercise session. First we do DES in CBC encryption mode using a key $K_1$ and $IV_1 = O^n$. Then we do DES in ECB decryption mode using $K_1$. And then DES in CBC ...
4
votes
2answers
304 views

Universal hash functions with homomorphic XOR property

Let $H = \{h_r : U \rightarrow [m]\}$. What are the currently known most efficient algorithms such that $H$ is a universal family and fulfils the homomorphic XOR operation property $\forall h \in H \...

15 30 50 per page